可疑文件 21/39 (53.85%)

显示全部楼层 · 发表于 2009-2-22 03:34:21

可疑文件 21/39 (53.85%)

To：费尔、江民

样本很肥，在这儿下载：
ht tp://www.5189wg.com/tl_sds0611.exe
（不报的～～～上报一下）

文件 tl_sds0611.exe 接收于 2009.02.21 19:30:03 (CET)
结果: 21/39 (53.85%)
反病毒引擎版本最后更新扫描结果
a-squared 4.0.0.93 2009.02.21 Generic.PWS.Games!IK
AhnLab-V3 2009.2.21.0 2009.02.21 -
AntiVir 7.9.0.87 2009.02.21 TR/Dropper.Gen
Authentium 5.1.0.4 2009.02.21 W32/Backdoor2.ZTX
Avast 4.8.1335.0 2009.02.20 Win32:OnLineGames-FFZ
AVG 8.0.0.237 2009.02.21 -
BitDefender 7.2 2009.02.21 Trojan.PWS.OnlineGames.AAJB
CAT-QuickHeal 10.00 2009.02.20 -
ClamAV 0.94.1 2009.02.21 Trojan.Pakes-248
Comodo 983 2009.02.20 -
DrWeb 4.44.0.09170 2009.02.21 Trojan.PWS.Wsgame.origin
eSafe 7.0.17.0 2009.02.19 Suspicious File
eTrust-Vet 31.6.6368 2009.02.20 -
F-Prot 4.4.4.56 2009.02.21 W32/Backdoor2.ZTX
F-Secure 8.0.14470.0 2009.02.21 -
Fortinet 3.117.0.0 2009.02.21 W32/Packed.2D18!tr
GData 19 2009.02.21 Trojan.PWS.OnlineGames.AAJB
Ikarus T3.1.1.45.0 2009.02.21 Generic.PWS.Games
K7AntiVirus 7.10.639 2009.02.21 -
Kaspersky 7.0.0.125 2009.02.21 -
McAfee 5531 2009.02.21 -
McAfee+Artemis 5531 2009.02.21 New Malware.jn
Microsoft 1.4306 2009.02.21 PWS:Win32/Lolyda.W
NOD32 3875 2009.02.21 a variant of Win32/PSW.OnLineGames.NTM
Norman 6.00.06 2009.02.20 -
nProtect 2009.1.8.0 2009.02.21 -
Panda 10.0.0.10 2009.02.21 Trj/Agent.LIW
PCTools 4.4.2.0 2009.02.21 Packed/Themida
Prevx1 V2 2009.02.21 -
Rising 21.17.52.00 2009.02.21 -
SecureWeb-Gateway 6.7.6 2009.02.21 Trojan.Dropper.Gen
Sophos 4.39.0 2009.02.21 Mal/PWS-W
Sunbelt 3.2.1855.2 2009.02.17 -
Symantec 10 2009.02.21 -
TheHacker 6.3.2.4.262 2009.02.21 -
TrendMicro 8.700.0.1004 2009.02.20 -
VBA32 3.12.10.0 2009.02.21 Backdoor.Win32.Hupigon.nqr
ViRobot 2009.2.20.1617 2009.02.20 -
VirusBuster 4.5.11.0 2009.02.21 Packed/Themida
附加信息
File size: 1963520 bytes
MD5...: e3d7c798c52875e303e9d93b57e3f129
SHA1..: 1307e18578eb5abb12bd1a742744f20425c71950
SHA256: 9fc1ecefd57b4f967276e7ad08c13a42eb278ac453901eac182274264ea10cf1
SHA512: 6b27025440cc55426453fa3b224c5111abd6f877bd5ef77571f1125c0f436fd5
d51a9f068ae8d9f16902afa488276bd73f84010421bc97c7fa62b4cf209e8429
ssdeep: 49152:99264EOd+13h43i2cqjCw2UKUP2F6CJYxAC3uaeE+zA:Swh43i2cvpUKUP
wJiArzA

PEiD..: -
TrID..: File type identification
Win64 Executable Generic (63.0%)
Win32 Executable MS Visual C++ (generic) (27.7%)
Win32 Executable Generic (6.2%)
Generic Win/DOS Executable (1.4%)
DOS Executable Generic (1.4%)
PEInfo: PE Structure information

VirSCAN.org Scanned Report :
Scanned time : 2009/02/22 02:32:16 (CST)
Scanner results: 38%的杀软(14/37)报告发现病毒
File Name    : tl_sds0611.exe
File Size    : 1963520 byte
File Type    : PE32 executable for MS Windows (GUI) Intel 80386 32-bit
MD5          : e3d7c798c52875e303e9d93b57e3f129
SHA1          : 1307e18578eb5abb12bd1a742744f20425c71950
Online report  : ht tp://virscan.org/report/6e5aa07f982aca8405be29b809e59d0d.html

Scanner       Engine Ver    Sig Ver          Sig Date Time Scan result
a-squared    4.0.0.32       20090221170551 2009-02-21  2.29 Generic.PWS.Games!IK
安博士V3    2009.02.21.00 2009.02.21       2009-02-21  1.13 -
AntiVir       7.9.0.87       7.1.2.59       2009-02-21  1.87 TR/Dropper.Gen
安天          2.0.18       20090221.2192020  2009-02-21  0.12 -
Authentium    5.1.1          200902211511    2009-02-21  1.07 W32/Backdoor2.ZTX (Exact)
AVAST!       3.0.1          090220-0       2009-02-20  0.07 -
AVG          7.5.52.442    270.11.2/1964    2009-02-21  2.14 -
BitDefender 7.81008.2680141 7.23797          2009-02-22  4.81 Trojan.PWS.OnlineGames.AAJB
CA (VET)    9.0.0.143    31.6.6368       2009-02-21  6.52 -
ClamAV       0.94.2       9019             2009-02-21  0.79 Trojan.Pakes-248
Comodo       3.8          986             2009-02-20  0.45 -
CP Secure    1.1.0.715    2009.02.21       2009-02-21  7.59 -
Dr.Web       4.44.0.9170    2009.02.21       2009-02-21  4.44 Trojan.PWS.Wsgame.origin
F-Prot       4.4.4.56       20090221       2009-02-21  1.11 W32/Backdoor2.ZTX (exact)
F-Secure    5.51.6100    2009.02.21.01    2009-02-21  5.06 -
飞塔          2.81-3.117    10.70          2009-02-21  0.39 W32/Packed.2D18!tr
GData       19.3292/19.232  20090221       2009-02-21  4.89 Win32:OnLineGames-FFZ [Trj] [Engine:B]
ViRobot       20090220       2009.02.20       2009-02-20  0.58 -
Ikarus       T3.1.01.45    2009.02.21.72334  2009-02-21  3.97 Generic.PWS.Games
江民杀毒    11.0.706       2009.02.21       2009-02-21  1.80 -
卡巴斯基    5.5.10       2009.02.21       2009-02-21  0.36 -
金山毒霸    2009.2.5.15    2009.2.21.20    2009-02-21  1.65 -
迈克菲       5.3.00       5532             2009-02-21  3.12 -
Microsoft    1.4306       2009.02.21       2009-02-21  15.15  PWS:Win32/Lolyda.W
mks_vir       2.01          2009.02.21       2009-02-21  2.74 -
Norman       6.00.06       6.00.00          2009-02-20  8.01 -
熊猫卫士    9.05.01       2009.02.20       2009-02-20  3.49 Trj/Agent.LIW
趋势科技    8.700-1004    5.860.18       2009-02-21  0.03 -
Quick Heal    10.00          2009.02.20       2009-02-20  1.57 -
瑞星          20.0          21.17.52.00    2009-02-21  1.41 -
Sophos       2.83.3       4.38             2009-02-22  2.86 Mal/Behav-285
Sunbelt       4819          4819             2009-02-16  0.57 -
赛门铁克    1.3.0.24       20090221.004    2009-02-21  0.07 -
nProtect    20090221.01    3171116          2009-02-21  7.89 -
The Hacker    6.3.2.4       v00262          2009-02-21  0.85 -
VBA32       3.12.10.0    20090221.1611    2009-02-21  1.67 Backdoor.Win32.Hupigon.nqr
VirusBuster 4.5.11.10    10.101.21/930783  2009-02-21  3.42 -

显示全部楼层 · 发表于 2009-2-22 07:23:41

又是冒牌外挂呀！

to kaba kill,waiting for reply。。。

[ 本帖最后由 FLogo 于 2009-2-22 15:34 编辑 ]

显示全部楼层 · 发表于 2009-2-22 08:07:03

过诺顿

显示全部楼层 · 发表于 2009-2-22 08:57:07

名称: Packed/Themida
类型: Sequence

描述:

文件:
c:\users\administrator\desktop\tl_sds0611.exe

显示全部楼层 · 发表于 2009-2-22 09:06:06

Ultra String Reference
Address Disassembly                            Text String
004010E0 push ebp                            (initial cpu selection)
004010EA mov    esi, 00403688                   fuck_trojan
0040116A push 00403664                         cmd /c cacls %s /e /p everyone:f
0040119B push 00403640                         cmd /c cacls "%s" /e /p everyone:f
004011CC push 00403618                         cmd /c sc config ekrn start= disabled
004011FD push 004035F8                         cmd /c taskkill /im ekrn.exe /f
0040122E push 004035D8                         cmd /c taskkill /im egui.exe /f
0040125F push 004035B4                         cmd /c taskkill /im scanfrm.exe /f
00401294 push 0040359C                         \system32\killkb.dll
004012B0 push 00403598                         bin
004012D7 push 00403580                         rundll32.exe %s, droqp
00401313 push 00403558                         cmd /c sc config avp start= disabled
00401344 push 00403538                         cmd /c taskkill /im avp.exe /f
0040137B push 0040352C                         update.dll
004013B9 push 00403598                         bin
004013EE mov    esi, 00403528                   _
00401400 push 0040326C                         o12askslyzo7k8ymc5mtpide06bwys6julmvcbtbbjk8dlonc6tlpbiudywa
00401424 push 00403210                         o12askslyzo7k8ymc5mtpide06bwys6julmvcbtbbjk8dlonc6tlpleutewa
00401445 push 00403008                         <p
00401464 push 00403000                         scan

显示全部楼层 · 发表于 2009-2-22 09:06:38

作者看来很恨eset和kaspersky

显示全部楼层 · 发表于 2009-2-22 09:13:40

rs 0

显示全部楼层 · 发表于 2009-2-22 15:34:00

原帖由 FLogo 于 2009-2-22 07:23 发表
又是冒牌外挂呀！

to kaba kill,waiting for reply。。。

恩，游戏中换了几个ID发给我，就觉得此外挂肯定有问题

[病毒样本] 可疑文件 21/39 (53.85%)

本帖子中包含更多资源